[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real m
From: |
Paolo Bonzini |
Subject: |
Re: [Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real mode |
Date: |
Wed, 14 Sep 2016 00:53:36 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 |
On 13/09/2016 16:50, Brijesh Singh wrote:
> In SEV-enabled guest dma should be performed on shared pages. Since
> the SeaBIOS executes in non PAE mode and does not have access to C-bit
> to create a shared page hence disable the dma operation when reading
> from fw_cfg interface.
>
> Signed-off-by: Brijesh Singh <address@hidden>
> ---
> hw/nvram/fw_cfg.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
> index 6a68e59..aca99e9 100644
> --- a/hw/nvram/fw_cfg.c
> +++ b/hw/nvram/fw_cfg.c
> @@ -24,6 +24,7 @@
> #include "qemu/osdep.h"
> #include "hw/hw.h"
> #include "sysemu/sysemu.h"
> +#include "sysemu/kvm.h"
> #include "sysemu/dma.h"
> #include "hw/boards.h"
> #include "hw/isa/isa.h"
> @@ -1009,6 +1010,11 @@ static void fw_cfg_io_realize(DeviceState *dev, Error
> **errp)
> FWCfgIoState *s = FW_CFG_IO(dev);
> SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
>
> + /* disable dma on fw_cfg when SEV is enabled */
> + if (kvm_sev_enabled()) {
> + qdev_prop_set_bit(dev, "dma_enabled", false);
> + }
> +
> /* when using port i/o, the 8-bit data register ALWAYS overlaps
> * with half of the 16-bit control register. Hence, the total size
> * of the i/o region used is FW_CFG_CTL_SIZE */
>
>
>
As Michael said, a workaround is possible using -global. However, I
really think that SEV should be implemented in UEFI firmware. Because
it runs in 64-bit mode, it would be able to run in paged mode and it
would not have to encrypt everything before the SEV launch command.
For example secure boot can be used to authenticate the kernel against
keys provided by the owner in encrypted flash, or GRUB2 can be placed in
the firmware by the owner and used to boot from a LUKS-encrypted /boot
partition.
Paolo
- Re: [Qemu-devel] [RFC PATCH v1 10/22] sev: add SEV debug decrypt command, (continued)
- Re: [Qemu-devel] [RFC PATCH v1 10/22] sev: add SEV debug decrypt command, Paolo Bonzini, 2016/09/14
- Re: [Qemu-devel] [RFC PATCH v1 10/22] sev: add SEV debug decrypt command, Michael S. Tsirkin, 2016/09/14
- Re: [Qemu-devel] [RFC PATCH v1 10/22] sev: add SEV debug decrypt command, Paolo Bonzini, 2016/09/14
- Re: [Qemu-devel] [RFC PATCH v1 10/22] sev: add SEV debug decrypt command, Brijesh Singh, 2016/09/14
- Re: [Qemu-devel] [RFC PATCH v1 10/22] sev: add SEV debug decrypt command, Michael S. Tsirkin, 2016/09/14
[Qemu-devel] [RFC PATCH v1 08/22] sev: add SEV launch update command, Brijesh Singh, 2016/09/13
[Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real mode, Brijesh Singh, 2016/09/13
Re: [Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real mode,
Paolo Bonzini <=
Re: [Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real mode, Eduardo Habkost, 2016/09/14
Re: [Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real mode, Paolo Bonzini, 2016/09/14
Re: [Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real mode, Michael S. Tsirkin, 2016/09/14
Re: [Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real mode, Eduardo Habkost, 2016/09/14
Re: [Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real mode, Michael S. Tsirkin, 2016/09/14
Re: [Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real mode, Eduardo Habkost, 2016/09/14
Re: [Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real mode, Michael S. Tsirkin, 2016/09/21